7个[MD5: 3292FD 45BBB6 8FFDE5 5A954E 9AEE7F 6D8482 4936A6]

promised

C:\ABC\virus\f2.exe - 特征码 'Trojan-Downloader.Win32.Agent.bbb' 被发现
C:\ABC\virus\g3.exe - 特征码 'Trojan.Win32.StartPage.apb' 被发现
C:\ABC\virus\msqmx.sys - 特征码 'Trojan.Win32.StartPage.amd' 被发现
C:\ABC\virus\rlhpz.dll - 特征码 'Trojan-Downloader.Win32.QQHelper.ve' 被发现
C:\ABC\virus\rundllforour.exe - 特征码 'Win32.SuspectCrc' 被发现
C:\ABC\virus\update.exe - 特征码 'Trojan-Downloader.Win32.QQHelper' 被发现
C:\ABC\virus\winllogon.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
7 个文件被扫描
   (0 个压缩档 0 个文件)
7 个特征码被侦测
0 个可疑代码段被发现
耗时: 0:00.047

[ 本帖最后由 promised 于 2007-7-17 21:13 编辑 ]

1688388728

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9ZJO5KCR\virus[1].rar\rlhpz.dll - is an AdWare program Adware.QQHelp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9ZJO5KCR\virus[1].rar\f2.exe - is an AdWare program Adware.QQHelp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9ZJO5KCR\virus[1].rar\g3.exe - infected with Trojan.StartPage.20152
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9ZJO5KCR\virus[1].rar\update.exe - infected with Trojan.DownLoader.25783
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\9ZJO5KCR\virus[1].rar\winllogon.exe - infected with BackDoor.Pigeon.1604

Archive contains 5 infected items

wangjay1980

detected: Trojan program Trojan-Downloader.Win32.Agent.bbb        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/f2.exe
detected: Trojan program Trojan.Win32.StartPage.apb        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/g3.exe
detected: Trojan program Trojan-Downloader.Win32.QQHelper.ep        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/update.exe//PE_Patch
detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/winllogon.exe//NSPack//PE_Patch.MaskPE
detected: Trojan program Trojan.Win32.StartPage.apb        File: C:\Documents and Settings\Owner\×ÀÃæ\virus.rar/msqmx.sys

woai_jolin

===================================================================================================
NVCOD On Demand Scanner 5.80.02

NSE revision 5.91.02
nvcbin.def revision 5.90.00 of 2007/07/17 08:12:37 (810868 variants)
nvcmacro.def revision 5.90.00 of 2007/06/29 06:32:19 (20341 variants)
Total number of variants: 831209
Command line: "@C:\Users\Jason\AppData\Local\Temp\~OD8720.tmp"
===================================================================================================

       Time  Filename                                                     Virus name
---------------------------------------------------------------------------------------------------
- Scanning files matching: D:\v\winllogon.exe
      136 ms D:\v\winllogon.exe                                           Trojan W32/Hupigon.gen67 ()
- Scanning files matching: D:\v\f2.exe
       28 ms D:\v\f2.exe                                                  Trojan W32/Agent.BTKT ()
- Scanning files matching: D:\v\g3.exe
       16 ms D:\v\g3.exe                                                  Trojan W32/Malware.AAIO ()
- Scanning files matching: D:\v\msqmx.sys
      323 ms D:\v\msqmx.sys                                             
- Scanning files matching: D:\v\rlhpz.dll
        3 ms D:\v\rlhpz.dll                                             
- Scanning files matching: D:\v\rundllforour.exe
      105 ms D:\v\rundllforour.exe                                       
- Scanning files matching: D:\v\update.exe
       25 ms D:\v\update.exe                                              Trojan W32/DLoader.CQXR ()
- File D:\v\winllogon.exe quarantined.
- File D:\v\winllogon.exe deleted.
- File D:\v\f2.exe quarantined.
- File D:\v\f2.exe deleted.
- File D:\v\g3.exe quarantined.
- File D:\v\g3.exe deleted.
- File D:\v\update.exe quarantined.
- File D:\v\update.exe deleted.

===================================================================================================

The scanning started: 2007/07/17 21:08:15
               ended: 2007/07/17 21:08:17
Logged on as        : Jason
on hostname         : JASON-PC

Scanning results:
   Total number of files found..............................:       7
   Number of files scanned..................................:       7
   Number of files/directories skipped due to exclude list..:       0
   Number of files that could not be opened.................:       0
   Number of archive files unpacked.........................:       0
   Number of archive files not unpacked.....................:       0
   Number of infections.....................................:       4

Copyright (c) 1993-2005 Norman ASA.

wangjay1980

rundllforour.exe这个没问题

风雪

1184678288,2007-7-17 21:18:08,TrojanDownloader.Agent.bbb.eane,木马,mygood,D:\3\新建文件夹\新建文件夹\virus1.rar>>f2.exe,Manual scan
1184678288,2007-7-17 21:18:08,Trojan.StartPage.apb.bsil,木马,mygood,D:\3\新建文件夹\新建文件夹\virus1.rar>>g3.exe>>emb-1.exe,Manual scan
1184678288,2007-7-17 21:18:08,Trojan.StartPage.apb.bsil,木马,mygood,D:\3\新建文件夹\新建文件夹\virus1.rar>>msqmx.sys,Manual scan
1184678288,2007-7-17 21:18:08,Backdoor.CVM.ouqt,后门,mygood,D:\3\新建文件夹\新建文件夹\virus1.rar>>rundllforour.exe,Manual scan
1184678288,2007-7-17 21:18:08,TrojanDownloader.QQHelper.ep.uand,木马,mygood,D:\3\新建文件夹\新建文件夹\virus1.rar>>update.exe,Manual scan
1184678288,2007-7-17 21:18:08,Heuri.Possible/Packed,启发式扫描,mygood,D:\3\新建文件夹\新建文件夹\virus1.rar>>winllogon.exe,Manual scan
费尔。

坐在墙头

费尔   6个

tracydk

Starting the file scan:

Begin scan in 'F:\病毒样本\virus.rar'
F:\病毒样本\virus.rar
  [0] Archive type: RAR
  --> rlhpz.dll
      [DETECTION] Is the Trojan horse TR/Drop.QQHelpe.q.3
  --> f2.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.bbb.1101
  --> g3.exe
      [DETECTION] Is the Trojan horse TR/StartPage.apb
  --> update.exe
      [DETECTION] Is the Trojan horse TR/Dldr.QQHelpe.q.1
  --> winllogon.exe
      [DETECTION] Is the Trojan horse TR/Crypt.NSPI.Gen
  --> msqmx.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      The file was deleted!

扫描开始时间: 2007-7-17 21:19:33
扫描日志
NOD32 版本 2401 (20070716) NT
命令行: F:\virus\virus.rar

日期: 2007年7月17日  时间: 21:19:35
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\virus\virus.rar
F:\virus\virus.rar ?RAR ?rlhpz.dll<病毒 - Win32/TrojanDownloader.QQHelper 木马 变种>
F:\virus\virus.rar ?RAR ?f2.exe<病毒 - 可能是 Win32/TrojanDownloader.Agent.BBB 木马 变种>
F:\virus\virus.rar ?RAR ?g3.exe<病毒 - Win32/Rootkit.Agent.NAU 木马 变种>
F:\virus\virus.rar ?RAR ?update.exe<病毒 - Win32/TrojanDownloader.QQHelper 木马>
F:\virus\virus.rar ?RAR ?winllogon.exe<病毒 - Win32/TrojanDownloader.Delf.AXB 木马 变种>
F:\virus\virus.rar ?RAR ?msqmx.sys<病毒 - Win32/Rootkit.Agent.NAU 木马 变种>
已扫描文件数量: 7
已发现病毒数量: 6
完成时间: 21:19:35 总共扫描时间: 0 秒 (00:00:00)

zxy900906

Scan performed at: 2007-7-17 21:18:57
Scanning Log
NOD32 version 2402 (20070717) NT
Command line: C:\Documents and Settings\Administrator\桌面\virus.rar

Date: 17.7.2007  Time: 21:19:00
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\Administrator\桌面\virus.rar
C:\Documents and Settings\Administrator\桌面\virus.rar ?RAR ?rlhpz.dll - a variant of Win32/TrojanDownloader.QQHelper trojan
C:\Documents and Settings\Administrator\桌面\virus.rar ?RAR ?f2.exe - probably a variant of Win32/TrojanDownloader.Agent.BBB trojan
C:\Documents and Settings\Administrator\桌面\virus.rar ?RAR ?g3.exe - a variant of Win32/Rootkit.Agent.NAU trojan
C:\Documents and Settings\Administrator\桌面\virus.rar ?RAR ?update.exe - Win32/TrojanDownloader.QQHelper trojan - was a part of the deleted object
C:\Documents and Settings\Administrator\桌面\virus.rar ?RAR ?winllogon.exe - a variant of Win32/TrojanDownloader.Delf.AXB trojan
C:\Documents and Settings\Administrator\桌面\virus.rar ?RAR ?msqmx.sys - a variant of Win32/Rootkit.Agent.NAU trojan
C:\Documents and Settings\Administrator\桌面\virus.rar ?RAR ?rundllforour.exe - is OK
Number of scanned files: 8
Number of threats found: 6
Number of files cleaned: 1
Time of completion: 21:19:01 Total scanning time: 1 sec (00:00:01)